The fundamentals series teaches you how pipelines work. This series shows you how they actually get built — in real organisations, under real constraints, with real tradeoffs.
Every article is rooted in a genuine scenario: a team deploying to production multiple times a day without downtime, a startup standardising their GitHub Actions workflow before it becomes a mess, an enterprise migrating from Jenkins with zero appetite for risk.
⚡ Byte Size Summary Implement the four-phase Expand/Contract pattern — nullable column, batched backfill, code pivot, then constraint — so schema changes never ship coupled to application code Understand why Argo CD’s “rollback” can revert your container image but cannot touch a database schema, and why that gap is the actual thesis of zero-downtime deployment failures See the enforcement gap that let a smaller version of the same incident happen twice — and why process-only guardrails (PR review, runbooks) fail under deploy pressure The Story In the previous article we shifted from managing Kubernetes to managing applications. This article shows what happens when the database layer doesn’t get the same treatment. ...
⚡ Byte Size Summary Understand why a Helm sub-chart with a hardcoded deprecated API can pass CI, deploy cleanly, and still crash production ten minutes later See why admission-time governance and a managed control plane solve two completely different problems — and why conflating them is how teams get burned Walk away with a clearer sense of where platform ownership should actually sit as an organization scales The Story I was building an optimization model for scheduling — an internal Red Hat project, nothing exotic. Somewhere in the middle of it I noticed something uncomfortable: I wasn’t spending my time on the application anymore. I was spending it on the platform underneath it. Roughly half my working hours were going into upgrade cycles — chasing down which APIs had quietly disappeared and which of my dependencies would break the moment the Kubernetes cluster moved forward a minor version. ...
Pipelines in the Wild #4 Byte Size Summary Red Hat OpenShift Service on AWS (ROSA), Azure Red Hat OpenShift (ARO), and OpenShift Dedicated on GCP (OSD) are mature, SRE-operated platforms — same OpenShift surface, three clouds, control plane work you don’t own. When prerequisites are met, installs complete in the documented window. Enterprise timelines stretch when governance approval tracks and Terraform state hygiene are treated as afterthoughts, not when the platform fails. This article separates the solid platform from the enterprise wrapper, then covers what actually prevents pain on the IaC side: remote state before the first resource, scheduled drift detection, and platform-specific recovery when partial applies leave residue behind. ...
⚡ Byte Size Summary Secret management failures are invisible until they cause a production incident — start with RBAC and namespace isolation before the first workload goes live Storing secrets in a central vault solves the sprawl problem but introduces a new failure mode: rotation lag between the vault and the namespace-level Kubernetes secret The real unsolved problem isn’t technical — it’s knowing who owns the approval and escalation path when a credential rotates at 2 AM across a multi-timezone team The Story In Article 02 we built retry logic and tiered alerting so transient pipeline failures don’t wake anyone up. This article tackles the credential layer underneath — because a retry won’t help when the secret itself is missing. ...
Byte Size Summary Most pipeline failures are transient — a registry returning a 503, a smoke test catching a slow cold start, a network blip during an image push. Retrying them automatically, with exponential backoff, means engineers never see them. The failures that reach a human should be the ones that actually need one. This article builds a retry wrapper and a three-tier alerting system (transient → silent, degraded → Slack warning, critical → PagerDuty page) on top of a GitHub Actions blue/green deploy workflow. The demo application is Waybill — a FastAPI shipment tracking API backed by PostgreSQL, where the health endpoint checks real database connectivity rather than returning a static 200. That distinction matters: a smoke test that only checks HTTP status is a smoke test that passes while your database is unreachable. By the end you’ll have a working repo you can run locally with Docker Compose and test today. ...
Byte size summary After reading this article, you will know how to implement a blue/green deployment pipeline on OpenShift that uses HAProxy-backed Route weight splitting for traffic control and Flagsmith for feature flag management — and more importantly, you will know where the implementation breaks silently. Specifically: the HAProxy propagation gap that lets your smoke tests lie to you, the partial rollout state that puts two versions in production simultaneously, and why the standard approach of patching a Route weight and immediately proceeding has cost teams I’ve worked with entire migrations. The implementation uses GitHub Actions for orchestration, oc commands for OpenShift-specific traffic control, and Flagsmith as the feature flag service. The patterns apply to AKS, EKS, and GKE with platform-specific variations called out. ...